CVE-2026-16102 Details

A vulnerability exists in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The issue arises because the default DCR policy does not properly validate the claim path for User Property mappers. This oversight allows attackers to write values to sensitive internal claim locations. An attacker with a standard user account and a limited Initial Access Token can exploit this flaw to forge administrative roles in their access token. Consequently, the attacker could take over other clients, steal confidential secrets, and potentially gain full administrative control over the realm.